While Viewing the windows server 2008 event log, I always find many security events 4625/logon as follows:
**An account failed to log on.** Subject: Security ID: SYSTEM Account Name: Sever-Name Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 10 Account For Which Logon Failed: Security ID: NULL SID Account Name: admin (or administrator or user or any) Account Domain: Sever-Name Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xc000006d Sub Status: 0xc000006a Process Information: Caller Process ID: 0x1b18 Caller Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: Sever-Name Source Network Address: Some-Remote-IP Source Port: Port#No (many ports in a row) Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate
The above tries comes from single IP using all possible usernames and ports.
My Questions are:
- Are these regular attacks?
- How worried should I be? Should I monitor and block every single IP or only when there are huge attack?
- Is blocking IP through windows firewall by choosing to block "All Programs" means that this IP will not be able to even use the web and email service?
- If the answer to #3 is yes, is there a way to only block the Machine / RDP Access? Is it enough?